Ubuntu 23.10: USN-6470-2 Severe: Axis Denial of Service Vulnerability

ubuntu

November 2, 2023

Axis could be made to crash or execute arbitrary code if it received specially crafted input.

Summary

Axis could be made to crash or execute arbitrary code if it received specially

crafted input.

Software Description:

- axis: SOAP implementation in Java

Details:

It was discovered that Axis incorrectly handled certain inputs. If a user or

an automated system were tricked into opening a specially crafted input file,

a remote attacker could possibly use this issue to cause a denial of service

or execute arbitrary code. (CVE-2023-40743)

Topics Covered

security advisory denial of service critical Ubuntu axis issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   libaxis-java                    1.4-28+deb10u1build0.23.10.1
   libaxis-java-doc                1.4-28+deb10u1build0.23.10.1

Ubuntu 23.04:
   libaxis-java                    1.4-28+deb10u1build0.23.04.1
   libaxis-java-doc                1.4-28+deb10u1build0.23.04.1

Ubuntu 22.04 LTS:
   libaxis-java                    1.4-28+deb10u1build0.22.04.1
   libaxis-java-doc                1.4-28+deb10u1build0.22.04.1

Ubuntu 20.04 LTS:
   libaxis-java                    1.4-28+deb10u1build0.20.04.1
   libaxis-java-doc                1.4-28+deb10u1build0.20.04.1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   libaxis-java                    1.4-25ubuntu0.1~esm1
   libaxis-java-doc                1.4-25ubuntu0.1~esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   libaxis-java                    1.4-24ubuntu0.1~esm1
   libaxis-java-doc                1.4-24ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.